Planning of changes

Plain-language summary

New in the 2022 edition: when you decide the ISMS needs to change — a new scope, a new cloud platform, a reorganisation, a new control framework — carry the change out in a planned way rather than letting it happen.

What the clause is really asking

This single-sentence clause arrived with the Harmonized Structure and mirrors ISO 9001's clause 6.3. It applies to changes to the management system itself, not to every IT change (those sit under Annex A control 8.32, change management). Typical triggers are a merger or divestment, moving a core service to the cloud, extending scope to a new site, replacing the risk methodology, adopting a new regulatory requirement such as the FSCA/PA Joint Standard, or changing the ISMS lead. 'Planned manner' is not defined, but ISO 9001 users know what auditors expect: the purpose of the change and its potential consequences considered, the integrity of the ISMS maintained during the change, resources confirmed, and responsibilities reassigned. The evidence is a short change record, not a new procedure.

What auditors look for

Auditors ask what has changed in the ISMS since the last audit and then ask to see how it was planned. A new cloud service with no updated scope, risk assessment or SoA is the textbook finding. They check that significant changes went through the organisation's change or project process with information security considered, and that documents were updated afterwards (scope, asset inventory, risk register, SoA, policies). Because the clause is new, they also check the organisation knows it exists — a mature ISMS with no change records at all suggests changes were not planned.

Typical evidence

ISMS change log or change requests for significant changes (scope, structure, methodology, major systems, suppliers, regulations); impact assessments considering purpose, consequences, integrity of the ISMS, resources and responsibilities; updated ISMS documents following the change; management-review discussion of planned changes.

How to comply — recommendations

Add an 'ISMS changes' tab to your existing change or project process with five fields: what is changing and why, which ISMS elements it touches (scope, risks, controls, documents, roles), the risks of the change itself, who owns the transition, and what is updated afterwards. Fill it in for every significant change — a dozen a year at most for most organisations. Make 'planned changes to the ISMS' a management-review input so leadership sees them coming. If you already operate ISO 9001's change-planning record, extend the same form.

Common nonconformities

Significant ISMS changes (scope, cloud migration, reorganisation) made without planning or impact assessment; ISMS documents not updated after change; change management applied to IT changes only, not to the management system; no record of who owned the transition; changes not raised at management review.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleManagement of change grows teeth: the strengthened clause 6.3
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.